more reasonable check for whether or not a user auth is present, addresses #602